blob: bceca8f300e4b50013b2fb9d8265e4e8478d60d5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
#!/bin/sh
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
# Generate a test certification authority certificate
here=`echo "import os; print os.path.realpath('$0')" | python`; here=`dirname $here`
mkdir -p $1
root=`echo "import os; print os.path.realpath('$1')" | python`
host=$2
# Don't override existing certificate
if [ -f $root/cert/ca.crt ]; then
exit 0
fi
# Generate openssl configuration
mkdir -p $root/cert
umask 0007
cat >$root/cert/openssl-ca.conf <<EOF
[ req ]
default_bits = 1024
encrypt_key = no
prompt = no
distinguished_name = req_distinguished_name
x509_extensions = v3_ca
[ req_distinguished_name ]
C = US
ST = CA
L = San Francisco
O = $host
OU = authority
CN = $host
emailAddress = admin@$host
[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer:always
basicConstraints = CA:true
[ca]
default_ca = ca_default
[ca_default]
certificate = $root/cert/ca.crt
private_key = $root/cert/ca.key
serial = $root/cert/ca-serial
database = $root/cert/ca-database
new_certs_dir = $root/cert
default_md = sha1
email_in_dn = no
default_days = 365
default_crl_days = 30
policy = policy_any
copy_extensions = none
[ policy_any ]
countryName = supplied
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional
EOF
rm -rf $root/cert/*.crt $root/cert/*.pem $root/cert/hash
rm -f $root/cert/ca-database
echo 1000 > $root/cert/ca-serial
touch $root/cert/ca-database
# Generate the certification authority certificate
openssl req -new -x509 -config $root/cert/openssl-ca.conf -out $root/cert/ca.crt -keyout $root/cert/ca.key
# Add to the hash directory and rehash
mkdir -p $root/cert/hash
cp $root/cert/ca.crt $root/cert/hash
perl /usr/bin/c_rehash $root/cert/hash
|
